A single certificate can be installed in a keystore as many times as you want under as many
aliases as you want. However, the webserver generally only uses one of them
(in Tomcat for example, it's the tomcat one).

If you are using a web server for virtual hosting, and have multiple domain names running from a
single server, you need to be aware of the fact that the authentication and decryption
happens _before_ the identification of the virtual host, so as far as I know there is no way for a
single server on a single ip address to have multiple certificates.

(If I'm wrong about this I'd really like to know, because I'd like to do it.)

Bill

Yes

I'm not sure what you mean by match. Also, the client gets to decide
how it wants to interpret the various names in the certificate. It
would not surprise me to find clients that simply use the first CN and
ignore the rest. As another wrinkle, the relevant RFC on the issue, RFC
2818, says that you should be using  subjectAltName extension of type
dNSName instead of CN. Please RFC 2818 section 3.1
(http://www.rfc-editor.org/rfc/rfc2818.txt).

Some people are confused by the matching requirement. The basic rule
is: whatever address the user tells the browser to use to get to the
site, that address need to be in the CN or subjectAltName field. Here
are a few examples of the implications of this. Suppose your
certificate says www.widget.com in the CN of the certificate:

If the user asks the browser to go to https://www.widget.com/whatever..
the browser will accept the name in CN

If it just so happens that www.widget.com is at 192.168.133.71 and the
user doesn't believe in DNS and instead enters
https://192.168.133.71/whatever... the browser should issue the
standard warning about a mismatched name.

If the user is really clever and lazy and goes to that site all the
time then maybe they'll make an entry in their local /etc/hosts file so
that xyz maps to 192.168.133.71. When they tell the browser to go to
https://xyz/whatever... the browser will go to the right address but it
will then give the mismatched name warning when it gets the cert.

However, if that cert also had CNs of 192.168.133.71 and xyz then all
these connections would proceed without warning.